problems with login page/paypal database

[d2u77]

Every time I try to login to my page it takes me to the invalid login page. I have tried valid usernames and passwords and they still don't work. I have echoed the login variables and I know they are getting to the validation page. I also echoed the first result variable and get a Result ID #2. Not sure what that means. Here is the query string and what I am trying to do with it:

<?php
session_start();
$password=$POST["username"];
$username=$POST["password"];
echo "$password";
echo "$username";
$db = mysql_connect("servername", "serversignon", "serverpwd");
mysql_select_db("dbname", $db);

$result = mysql_query("SELECT * FROM paypal");

if ($myrow = mysql_fetch_array($result)) {
$hash = mysql_result($result,0,"password");
$salt = substr($hash, 0, 2);
$password = crypt($password,$salt);
$result2 = mysql_query("SELECT * FROM paypal WHERE username = $username AND password = $password");

if (!empty($result2)) {
if ($myrow2 = mysql_fetch_array($result2)) {
$active = $myrow2["active"];
$wore = $myrow2["first_name"];
$location = getenv("REQUEST_URI");
$host = getenv("REMOTE_HOST");
$today = (date("Y-m-d H:i:s"));
$first_name = $myrow2["first_name"];
$last_name = $myrow2["last_name"];
$payer_email = $myrow2["payer_email"];
$item_name = $myrow2["item_name"];
$name = "$first_name $last_name";

Any help would be great. Thanks

[daphreeek]

you have got 2 queries but only need 1:

<?php 
session_start(); 
$password=$_POST["username"]; 
$username=$_POST["password"]; 
echo "Username: $username<br>"; 
echo "Password: $password<br>"; 
$db = mysql_connect("servername", "serversignon", "serverpwd"); 
mysql_select_db("dbname", $db); 

$result2 = mysql_query("SELECT * FROM paypal WHERE username='$username'"); 

if (!empty($result2)) { 
   $hash = $myrow2["password"];
   $salt = substr($hash, 0, 2); 
   $password = crypt($password,$salt); 
   if ($hash == $password) {
      $myrow2 = mysql_fetch_array($result2);
      $active = $myrow2["active"]; 
      $wore = $myrow2["first_name"]; 
      $location = getenv("REQUEST_URI"); 
      $host = getenv("REMOTE_HOST"); 
      $today = (date("Y-m-d H:i:s")); 
      $first_name = $myrow2["first_name"]; 
      $last_name = $myrow2["last_name"]; 
      $payer_email = $myrow2["payer_email"]; 
      $item_name = $myrow2["item_name"]; 
      $name = "$first_name $last_name"; 
   }else{
   header("location: invalid_login.php");
   exit;
}
}else{
   header("location: invalid_login.php");
   exit;
}

echo "Name: $name";
?>

That should return thier username, password and full name 🙂

also - why was the first query there? it didnt actually do anything as that data was never used.

• matt

[d2u77]

Not sure why it was there. The site was created long before I stepped on the scene. I figured it had something to do with decrypting the password from paypal. I was just using what I had to work with. Should I take that part out?

Thanks for all the help. This is my first subscriber site and the first site that I am taking over for someone else, usually I just do logins and create the site from scratch so I know what everything does.